Loading story…
A high-volume phishing campaign delivered the Hupigon remote access Trojan to faculty and students at U.S. colleges and universities using adult dating-themed lures. Proofpoint reported that the emails urged recipients to click one of two links, triggering the download of an executable that installed the malware. The activity ran from April 13 to April 17 and peaked at roughly 80,000 messages over two days, with more than 150,000 emails sent across over 60 industries; about 45% of the messages targeted the education sector.
Once installed, Hupigon gave attackers remote access and capabilities including rootkit functionality, webcam monitoring, keystroke logging, and password theft. Researchers observed command-and-control traffic to eth[.]ceo at 142.54.162[.]66, also noting ooeth[.]com on the same IP and the delivery domain down.gogominer[.]com on nearby address space at 142.54.162[.]67. Although Hupigon has previously been linked to state-sponsored APT activity, Proofpoint assessed this operation as crimeware based on its mass-distribution tactics, scale, and technical infrastructure.
Get the infrastructure and lures behind it.
5 events from the most recent confirmed update back to the earliest known activity.
Between April 14 and April 15, 2020, the campaign reached roughly 80,000 messages, coinciding with an observed payload rotation. One payload seen on April 14 had SHA-256 8e2f624f7bf79f35951fa8a434537caa7d82dfbdf0bcd97461f879c43eece7fa, while another seen on April 15 had SHA-256 373c7986a56ee7b428757ac7862676a6b5bbaaa1aee4122747fce5680ae024ff.
Between April 13 and April 17, 2020, attackers ran a high-volume phishing campaign using adult dating lures to deliver Hupigon, primarily targeting faculty and students at U.S. colleges and universities. Clicking either lure link downloaded an executable that installed the RAT.
Proofpoint said Hupigon had been linked to historic APT campaigns based on builder language, open-source breach reporting, and reports of similar actor behavior. The cited historical activity spanned 2010 to 2012.
Proofpoint noted that the Hupigon remote access Trojan has existed since at least 2006. The malware is historically associated with remote access, rootkit, webcam monitoring, keystroke logging, and password theft capabilities.
Proofpoint reported that the malware initiated command-and-control communication via eth[.]ceo at 142.54.162[.]66, with ooeth[.]com also on that IP and delivery domain down.gogominer[.]com on nearby address space at 142.54.162[.]67. The company assessed the operation as crimeware rather than state-sponsored activity based on its distribution methods, scale, and technical associations.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers linked multiple phishing-driven campaigns to **HawkEye** and related surveillance malware, describing a long-running credential-theft threat that targeted organizations across dozens of countries and industries. The malware was delivered through lures such as airline ticket confirmations and fake payment documents, often inside compressed archives or executable attachments, and was also tracked alongside the similar **Predator Pain** family. Victims included industrial, engineering, manufacturing, government, higher education, retail, telecommunications, and professional services organizations, with especially heavy targeting reported in the United States, Australia, Canada, parts of Asia, and the Middle East. The malware acted as a feature-rich spyware and keylogger, stealing browser, email, messaging, and FTP credentials, capturing keystrokes, screenshots, clipboard data, and system information, and in some cases injecting into legitimate `.NET` binaries such as `RegAsm.exe` and `vbc.exe`. Investigators said stolen data was exfiltrated through SMTP email, HTTP, PHP web panels, and FTP, including periodic submissions to attacker-controlled mailboxes; one variant checked external connectivity and included the victim’s public IP address in exfiltration messages. Kaspersky also tied Hawkeye-based tooling to **Operation Ghoul**, a financially motivated spear-phishing operation that hit more than 130 organizations and used both malware delivery and phishing pages to harvest accounts.
Aug 15, 2026
A coordinated phishing campaign targeted at least 18 American universities over several months used the open-source Evilginx phishing kit to bypass multi-factor authentication (MFA) and compromise student and staff accounts. Attackers employed adversary-in-the-middle (AiTM) tactics, leveraging personalized emails with short-lived TinyURLs that mimicked university single sign-on (SSO) portals. By capturing both credentials and session cookies, the attackers were able to fully take over accounts, despite MFA protections. The campaign demonstrated advanced operational security, including frequent changes to attack links and the use of services like Cloudflare to obscure infrastructure, as detailed in Infoblox's investigation. Separately, Harvard University experienced a breach of its Alumni Affairs and Development office systems, attributed to a successful mobile phishing ("mishing") attack. The attacker gained access to internal systems, which the university subsequently secured. This incident highlights the growing trend of mobile-first phishing strategies that bypass traditional desktop and network defenses, posing significant risks to organizations with distributed workforces and sensitive data. The breach underscores the need for dedicated mobile threat defense solutions, as standard MDM and UEM tools are insufficient against sophisticated mobile phishing attacks.
Jun 29, 2026
Recent reporting highlights multiple **social-engineering-driven malware delivery** efforts that culminate in remote access and persistent compromise. In South Korea, attackers distributed **counterfeit adult games** via popular “webhard” file-sharing services; victims received a ZIP containing a decoy `Game.exe` launcher that stages additional components (`Data1.Pak`, `Data2.Pak`, `Data3.Pak`) and ultimately injects **QuasarRAT** (aka **xRAT**), enabling host profiling, keylogging, and unauthorized file transfer. The execution chain included masqueraded artifacts such as `GoogleUpdate.exe` and `WinUpdate.db`, with AES used to decrypt/extract shellcode prior to privilege escalation and RAT injection. Separately, a spear-phishing campaign weaponized news about a purported **Nicolás Maduro arrest** to deliver a **backdoor**: emails carried a ZIP with a lure executable (`Maduro to be taken to New York.exe`) alongside a malicious DLL (`kuguo.dll`) that abuses a legitimate KuGuo binary for execution. Post-run behavior included replication to `C:\ProgramData\Technology360NB`, persistence via an auto-start renamed binary (`DataTechnology.exe`), and C2 beaconing for tasking and configuration updates; researchers noted tradecraft consistent with **Mustang Panda** but said attribution was not yet confirmed. A separate research note described **GravityRAT** reemerging as a multi-platform RAT with expanded **Android** targeting (in addition to Windows/macOS), emphasizing mobile endpoints as increasingly high-value targets for data theft and persistent access, though it did not describe the same specific campaigns as the Windows-focused lures above.
Jun 29, 2026